TROJ_KRYPTK.SMUF

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{Random File Name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Name} = "%Application Data%\{Random File Name}.exe"

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = "no"

(Note: The default value data of the said registry entry is "yes".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;"

It adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
DisableTaskMgr = 1

Other Details

This Trojan deletes the initially executed copy of itself

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

• Failed to read system files configuration. Start a system diagnostics application to scan your hard disk for errors and performance problems.
• A performance problem with one or more installed IDE / SATA hard drives has been detected. System restart is highly recommended.
• Un error ocurrio durante la lectura de los ficheros del sistema. Ejecute la utilidad diagnostica del sistema para chequear su unidad del disco duro para errores.
• El sistema ha detectado un problema con uno o mas IDE / SATA discos duros instalados. Vd. esta aconsejado a reiniciar el sistema.
• Ein Fehler beim Lesen Systemdateien eingetreten. Fuhren Sie ein Diagnoseprogramm fur Fehlerbestimmung durch.
• Das System hat ein Problem mit einem oder mehreren installierten IDE / SATA-Festplatten erkannt. Es wird empfohlen, das System neu zu starten.
• Errore durante la lettura di file di sistema Lanciate l'utilita di diagnostica del sistema per verificare il hard disk per gli errori.
• Il sistema ha rilevato un problema con uno o pi? hard disk IDE / SATA istallati. Si raccomanda di riaccendere il sistema.
• utilitaire de diagnostique du systeme pour detecter les erreurs sur votre disque dur.
• Le systeme a detecte un probleme avec un ou plusieurs disques durs IDE / SATA installes. Nous vous recommandons de redemarrer votre systeme.
• Sistem dosyalar? okuma s?ras?nda hata olusmustur. Sistem tan?mlama yard?mc? program?n? sabit disk surucusunu kontrol etmek icin baslay?n.
• Sistem yuklenmis bir veya fazlas? olan IDE / SATA sabit disklerde hatay? tespit etti. Sisteminizi yeniden baslatman?z tavsiye edilir.

NOTES:
This Trojan may perform the following routines:

• Show defrag window
• Download and saves a file from a URL
• Change wallpapper
• Display dialog boxes
• Hide files
• Terminate/delete itself
• Show balloon messages in the system tray